Ransomware Prevention and Remediation Services Augusta-Richmond County

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an existential danger for businesses of all sizes vulnerable to an attack. Different versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with additional as yet unnamed viruses, not only encrypt on-line data files but also infiltrate all accessible system restores and backups. Files replicated to off-premises disaster recovery sites can also be encrypted. In a poorly architected system, it can render automatic recovery impossible and effectively knocks the entire system back to zero.

Restoring applications and information following a ransomware intrusion becomes a sprint against time as the targeted organization struggles to contain, clear the virus, and resume enterprise-critical operations. Because ransomware requires time to replicate across a network, assaults are usually sprung during weekends and nights, when successful attacks are likely to take more time to notice. This multiplies the difficulty of promptly marshalling and organizing a knowledgeable mitigation team.

Progent has an assortment of help services for protecting Augusta-Richmond County enterprises from crypto-ransomware attacks. Among these are staff education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and quarantine day-zero modern malware attacks. Progent in addition offers the services of veteran crypto-ransomware recovery professionals with the skills and commitment to reconstruct a compromised network as soon as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not ensure that distant criminals will respond with the keys to decipher any or all of your files. Kaspersky determined that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to piece back together the key components of your Information Technology environment. Absent access to full system backups, this calls for a wide complement of skills, well-coordinated project management, and the willingness to work non-stop until the recovery project is done.

For two decades, Progent has made available professional Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP applications. This breadth of expertise gives Progent the skills to efficiently determine necessary systems and organize the surviving pieces of your computer network system following a ransomware attack and assemble them into an operational system.

Progent's recovery team utilizes state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the importance of working swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to put essential systems back on line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Recovery
A client sought out Progent after their organization was brought down by Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean state hackers, suspected of using technology leaked from the U.S. NSA organization. Ryuk attacks specific companies with limited tolerance for disruption and is one of the most profitable instances of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom (exceeding $200K) and praying for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to quickly assess and prioritize the most important elements that needed to be recovered to make it possible to restart departmental functions:

• Active Directory
• Electronic Mail
• Financials/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then performed rebuilding and storage recovery of critical systems. All Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Off-Line Data Files) on team workstations to recover email messages. A recent offline backup of the businesses financials/MRP systems made it possible to return these required programs back on-line. Although a lot of work was left to recover totally from the Ryuk attack, core systems were recovered rapidly:

Throughout the following month critical milestones in the recovery project were accomplished through close collaboration between Progent team members and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Exchange Server with over four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control functions were 100% functional.
• A new Palo Alto 850 firewall was brought online.
• Most of the desktops and laptops were functioning as before the incident.

Conclusion
A possible business-ending disaster was evaded due to hard-working experts, a wide range of technical expertise, and close collaboration. Although in hindsight the ransomware virus penetration described here could have been identified and disabled with current cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, cleanup, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Augusta-Richmond County
For ransomware system recovery expertise in the Augusta-Richmond County metro area, call Progent at 800-462-8800 or visit Contact Progent.